I had my first exposure to an alternate duties list in the US Air Force. It is a useful way to keep track of roles that go unnoticed (until someone leaves).

The list should include a description of each role and a primary and alternate for each. For example:

* Process and procedure documentation
* Application administrator
* Training program
* Timesheet approvals
* Systematic removal of accesses

In order for continuity to truly be in place, each person must be aware of their roles and commit to taking responsibility for them. Primaries and alternates must be equally capable of filling each role.

Alternate duties are not typically included in procedure documentation. The list should be kept separate and be updated routinely. Be sure to mark it with a "last updated" date.

As you can see, an alternate duties list has a place in the business world as well.

Kind regards,

Gideon

Gideon T. Rasmussen
CISSP, CISA, CISM, MVP
Charlotte, NC
http://www.virtualcso.com

http://www.ussecurityawareness.org
http://www.gideonrasmussen.com/rssfeed.xml
http://groups.yahoo.com/group/gideons-infosec-list

Posted: Fri Oct 26, 2007 8:30 pm

Copyright © 2002 - 2007 Gideon T. Rasmussen All Rights Reserved.
Legal Notices